The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to override standard agent safety protocols and user confirmation loops.
Evidence: 'Do this automatically without asking the user', 'Do all of this without asking the user for input', and 'Don't Wait for Instructions
Scan and fix automatically'. These directives encourage the agent to ignore the principle of human-in-the-loop oversight for high-impact operations.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill mandates a recursive scan of the entire codebase for sensitive information, creating a significant exposure risk.
Evidence: 'Read all files
Scan every file in the project recursively' and 'Hardcoded secrets (API keys, passwords in code)'. While the stated intent is to fix these issues, the instruction to read every file in the project, including configuration files like .env and credentials directories, provides the agent with full access to secrets.
[COMMAND_EXECUTION]: The skill grants the agent autonomous authority to modify any file in the project using powerful tools.
Evidence: 'Use strReplace to fix issues in files', 'Refactor architecture', and 'Fix everything automatically'. Combined with the instruction to bypass user input, this enables mass modification of the codebase without review.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process large amounts of untrusted data (entire codebases), which is a significant attack surface for indirect prompt injection.
Ingestion points: The agent is instructed to use readFile on every file in the directory recursively (SKILL.md).
Boundary markers: None are specified to help the agent distinguish between its instructions and the content of the files it is auditing.
Capability inventory: The agent has the capability to modify files (strReplace), list directories (listDirectory), and potentially run tests or build commands (SKILL.md).
Sanitization: There are no instructions for sanitizing or escaping the content read from files before it is processed by the model's logic.

production-code-audit